GENERAL TERMS & CONDITIONS 
for CyberVadis Services

1. Definitions

“Solution” means the CyberVadis online platform, operated by CyberVadis SAS and enabling the management of information and documents related to ISMS – Information Security Management System (“Cyber Security”). The platform is accessible via www.cybervadis.com

“Service” means the CyberVadis services offered by CyberVadis SAS and dedicated to the analysis of the maturity level of Company's Information Security Management System (“ISMS”) against industry benchmarks (cyber security performance), excluding any other performance-related services.

“Client(s)” means any company subscribing to the Solution enabling it to access information concerning the cyber security performance of its suppliers or of its own subsidiaries.

“Company(ies)” means any business entity registering on the Solution to provide information on its Cyber Security practices, upon request of a Client or voluntarily.

“Users” means, collectively, Companies and Clients.


2. Subject

CyberVadis operates the CyberVadis Services on behalf of Users aimed at monitoring the maturity level of their Information Security Management System. Access to this Service and use of the Solution are strictly subject to these General Terms & Conditions (hereinafter collectively referred to as the “Agreement”).


3. Confidentiality

3.1 Except as otherwise expressly authorized by the other party, CyberVadis and the Users shall only use the information and documents, of any nature whatsoever concerning the other Party, to which they might have access during or in connection with the use of the Solution, for the purpose of this Service. The content of evaluation questionnaires and information related to the CyberVadis evaluation methodology is considered as confidential information.

3.2. For purposes of the Service, the Company grants CyberVadis the non-exclusive and royalty-free right, on a worldwide basis, to host, store in cache mode, reproduce, and display, the information the Company will supply in the course of or in connection with the use of the Solution (the “Data”), and to use such Data to develop the CyberVadis database. The Company warrants and represents that it has all the rights and authorizations that are necessary to use the Data for purposes of the Service, and that it can freely grant the above license rights. The Company shall indemnify, defend and hold CyberVadis harmless from and against any and all losses, damages, liabilities, deficiencies, claims, actions, judgments, settlements, interest, awards, penalties, fines, costs or expenses of whatever kind, incurred by CyberVadis in connection with any claim, suit, action or proceeding that arises out of or relates to any breach of any representations, warranties, covenants, or obligations of the Company in connection with the Data under this Agreement.

3.3. Section 3.1 shall not apply to information pertaining to the public domain or to information known by the other Party prior to the performance of the Service. Each Party may disclose, without prior notification, approval or consent by the other Party, to Tax authorities and/or to such Party's representatives, externals counsel and advisors, any Confidential Information that is required to be disclosed by law or for audit purposes.

3.4 Notwithstanding Section 3.1 above, the Company will have the ability to share via the Solution its scorecards and other assessment results with certain Clients (or groups of Clients in the case of sector-based initiatives) subscribing to the Service via the Solution or via the Clients’ IT internal systems using third-party software integrating with, or otherwise connecting to, the Solution. As regards Company's names and performance medals ("Bronze", "Silver", "Gold") achieved as a result of the assessment, Company grants CyberVadis the right to classify and display them on the Solution, as well as the right to communicate and promote them in any media and on any support whatsoever, including in digital media.


4. Responsibility of CyberVadis

4.1. The Service shall be accessible by the Users at any time, 24 hours a day, 7 days a week, except during maintenance periods. CyberVadis shall not be responsible for any network-related failures, interruptions, outages, delays, system unavailabilities and other connectivity problems affecting the Solution or the Service. In the event that CyberVadis becomes aware of a data breach incident likely to severely compromise the security of the Solution or of the Service, or of the Users' Data, CyberVadis may, without notice, suspend momentarily the access to the Solution and to the Service in order to remedy the security breach in a timely manner. In such event, the CyberVadis shall not incur any liability to Users and Users shall not seek any compensation whatsoever from CyberVadis.

4.2. CyberVadis hereby disclaims all warranties, whether express or implied, as regards the Solution or the Service, or the use thereof, including, without limitation, any implied warranty as to the merchantability or fitness of the Solution to any particular purpose. CyberVadis does not warrant any results from the use of the Service and shall only be held to an obligation to use best endeavors ("obligation de moyens") in connection with the supply of the Service. CyberVadis does not warrant that the functionalities of the Solution or of the Service will meet the Users’ requirements. The Parties hereby acknowledge that no software is error-free and that not all software errors can be corrected in a cost-effective manner or even that they need to be corrected.


5. Responsibility of Users

5.1 The User agrees not to (i) interfere with or attempt to interfere with the proper working of the Solution; (ii) post or send to the Solution anything that contains a virus, or any harmful files (iii) reverse engineer the Solution.

5.2 The User is solely and uniquely responsible for the confidentiality of its employee’s username and password. It shall immediately notify CyberVadis of any unauthorized use of personal login data. In the absence of any such notification, all information received by CyberVadis from someone using the login and password of the User will be considered as having been sent by the User.


6. Responsibility of the Company

6.1. The Company shall cooperate with CyberVadis and ensure that it supplies in a timely manner to CyberVadis the data, information and documentation that are appropriate for or in connection with the operation of the Service.

6.2. The Company shall ensure that all data communicated is accurate, faithful and complete, and agrees not to post or transmit to the Solution any unlawful, fraudulent, harassing, libelous, or obscene data. The Company will be liable to third parties, and shall indemnify CyberVadis for the consequences of any false or unlawful data, information or documents provided to CyberVadis.


7. Subscription and fees

7.1. Use of the Solution by the Company is conditioned by the payment of a non-refundable, annual subscription fee dependent on the service level the Company has selected, as detailed on cybervadis.com/solution. All payments are due upon receipt.

7.2. Subject to the Company's right to terminate this Agreement in accordance with Article 11, CyberVadis reserves the right to revise its annual subscription fee schedule at any time and without incurring any liability whatsoever towards the Users.

7.3. A processing charge will apply for any method of payment other than credit card.

7.4 Companies with a billing address within the European Union (including the UK) are invoiced in euros only; all other companies can select between invoicing in euros or in U.S. dollars.

7.5. Bank-related fees (wire transfer and currency exchange fees, if any), as well as any debt collection services-related fees, shall be borne by the Company. Any failure by the User to make any payment when due may result in late payment fees on the past due amount at an amount corresponding to three (3) times the interest rate permitted under applicable law in France.


8. Intellectual property rights

8.1. The entirety of content on the Solution, including all methodologies, procedures, management tools, workshops, manuals, software packages, databases, questionnaires, designs, ideas, inventions, expertise, commercial methods, analysis methods, evaluation methodologies, evaluation results and all other rights covered by intellectual property rights developed, created or acquired by CyberVadis prior to supplying the Service or during operation of the Service, by any other means whatsoever, are and remain the exclusive property of CyberVadis. All data and individual entries made on the Solution by each User remain the property of this User. In case of subscription to the Premium or Corporate service, the Company will be granted a 12-month license to use and reproduce its scorecard and/or any of the associated communication tools from the date these results were published.

8.2. CyberVadis shall indemnify, defend and hold the User harmless from and against any and all losses, damages, liabilities, deficiencies, claims, actions, judgments, settlements, interest, awards, penalties, fines, costs or expenses of whatever kind, incurred by the User in connection with any claim that the Service infringes the intellectual property rights of third parties. The foregoing indemnification obligation is conditioned on CyberVadis shall be promptly notified in writing by the Company of such action, shall receive reasonable cooperation and assistance in such defence and shall take sole control of the defense or settlement of the claim. Subject to Section 10 CyberVadis shall pay any monetary judgments and costs finally awarded to the third party for such infringement, or any settlement of such claim to which CyberVadis has agreed.


9. Data Protection

While operating the Solution and providing the Service, CyberVadis, as a data controller, will process personal data in accordance with EU General Data Protection Regulation 2016 /679 (hereinafter “GDPR”). In connection with this processing, CyberVadis will take adequate physical, administrative and technical measures to protect such data against their accidental or unlawful destruction, accidental loss, alteration, disclosure, any unauthorized access, in particular over the Internet, as well as against any form of unlawful processing, in accordance with its Statement of Data Privacy, which can be viewed by clicking on the following link: cybervadis.com/legal-notice.


10. Limitation of liability

10.1. Notwithstanding any other provision in this Agreement, CyberVadis shall in no event be liable for any indirect loss or damage of any kind (including, without limitation, costs of cover, loss of profits, revenue, business, or loss or corruption of data) arising from or relating to this Agreement, including from (i) the use or inability to use the Solution or the Services, (ii) Clients’ use of the Data or the evaluation results of the Company; or (iii) a User's breach of its confidentiality obligations, regardless of the form of action.

10.2. In the case of Companies having sponsored subscription, the aggregate liability of CyberVadis, regardless of the legal ground, shall be strictly limited to the fees due for a chosen subscription specified on cybervadis.com/solution.

10.3. Subject to the above Section 10.2, in any remaining cases, the aggregate liability of CyberVadis, regardless of the legal ground, shall be strictly limited to the amount of the fees paid for the Services under this Agreement in the preceding 12 months.


11. Term – Termination

11.1. This Agreement shall enter into force, for an initial term of 12 months, starting on the date the User accepts the General Terms & Conditions, as validated by online confirmation on the CyberVadis platform. It will renew by tacit renewal per period of 12 months each, unless terminated by either of the parties.

11.2. The Company may terminate the Agreement at any time, for any reason, by discontinuing using the Solution and sending a written notification to CyberVadis. Documentation provided on electronic format will be deleted upon request. CyberVadis may terminate this Agreement without notice if the Company is found to be in material breach of any of the terms of this Agreement.

Sections 3, 8 and 10 shall survive any termination of the Agreement.


12. Assignment and transfer

The Company shall not assign or transfer the Agreement to any third party without the prior written consent of CyberVadis. CyberVadis may assign this Agreement to any direct or indirect subsidiaries or affiliated companies, including newly created company or to any other third party chosen by CyberVadis.


13. Modification

CyberVadis reserves the right, at any time, to modify the terms of this Agreement, subject to the Users ability to terminate the Agreement pursuant to Section 11.2 hereof. The Users will be informed of any such changes by means of publication on the web site cybervadis.com or through any other adequate means.


14. Applicable law and jurisdiction clause

This Agreement shall be governed, construed and interpreted in accordance with the laws of France. Any dispute arising out of or in connection with the Agreement, which cannot be settled amicably, shall be submitted to the competent court of Paris, France, which shall have exclusive jurisdiction notwithstanding the plurality of defendants.


15. Application of the Agreement

The Parties hereby agree that this Agreement sets forth the entirety of their respective rights and obligations relating to the subject matter thereof. This Agreement supersedes all prior agreements, negotiations and discussions between the Parties relating thereto. Any terms or conditions of any purchase order or other documents submitted by the User in connection with the access to or use of the Solution that are in addition to, different from, or inconsistent with this Agreement are not binding on CyberVadis and are ineffective.